Hacker News Reader

Intel SGX provides good isolation, it is still vulnerable to some side channel attacks, though it can be mitigated using a TSX hack.

Of course, SGX is not quite available yet on server class CPUs.

View on HN

Unfortunately, SGX is also vulnerable to timing attacks that leak the private session key, which breaks the enclave security model.

[0] http://www.sharcs-project.eu/m/documents/papers/a02-gotzfrie...

The details aren't completely spelled out here but SGX looks to be an interesting extension of the idea of "virtual machine per block of code" https://software.intel.com/en-us/sgx

It appears a runtime per-site-per-use license is required though.

The latest SDM strongly suggests that some future CPU will change this. Also, certain Linux x86 developers think that SGX support is vastly more likely to be acceptable upstream if this changes :)

Reply on news.ycombinator.com